Failing to create resource using subscription level ARM template

Question

Failing to create resource using subscription level ARM template

Varma 1,495

I am using following subscription level scope ARM template, but it is failing with following error. I am trying to create Resource group, Key vault and then ACR. but what not sure what is missing.

here is the main deploy file:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-11-01/subscriptionDeploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "resourceGroupName": {
      "type": "string"
    },
    "location": {
      "type": "string"
    },
    "acrName": {
      "type": "string"
    },
    "keyVaultName": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Resources/resourceGroups",
      "apiVersion": "2021-04-01",
      "name": "[parameters('resourceGroupName')]",
      "location": "[parameters('location')]",
      "properties": {}
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2021-04-01",
      "name": "nestedDeployment",
      "resourceGroup": "[parameters('resourceGroupName')]",
      "dependsOn": [
        "[resourceId('Microsoft.Resources/resourceGroups', parameters('resourceGroupName'))]"
      ],
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {
            "acrName": {
              "type": "string"
            },
            "keyVaultName": {
              "type": "string"
            },
            "location": {
              "type": "string"
            }
          },
          "resources": [
            {
              "type": "Microsoft.ContainerRegistry/registries",
              "apiVersion": "2019-05-01",
              "name": "[parameters('acrName')]",
              "location": "[parameters('location')]",
              "sku": {
                "name": "Standard"
              },
              "properties": {}
            },
            {
              "type": "Microsoft.KeyVault/vaults",
              "apiVersion": "2019-09-01",
              "name": "[parameters('keyVaultName')]",
              "location": "[parameters('location')]",
              "properties": {
                "sku": {
                  "family": "A",
                  "name": "standard"
                },
                "tenantId": "[subscription().tenantId]",
                "accessPolicies": [],
                "enabledForDeployment": true,
                "enabledForTemplateDeployment": true,
                "enabledForDiskEncryption": false
              }
            }
          ]
        },
        "parameters": {
          "acrName": {
            "value": "[parameters('acrName')]"
          },
          "keyVaultName": {
            "value": "[parameters('keyVaultName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          }
        }
      }
    }
  ]
}

and below is the param file:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "resourceGroupName": {
      "value": "DRG"
    },
    "location": {
      "value": "eastus"
    },
    "acrName": {
      "value": "myacrshyam12345"
    },
    "keyVaultName": {
      "value": "mykv890"
    }
  }
}

I am seeing following error :

PS I:\ARMTemplates\DevOps\ACR-KV> az deployment sub create --location eastus --template-file azuredeploy.json --parameters "@azuredeploy.parameters.json"

{"code": "InvalidTemplate", "message": "Deployment template validation failed: 'The template resource 'myacrshyam12345' at line '16' and column '5' is not valid: The template function 'RESOURCEGROUP' is not expected at this location. Please see https://aka.ms/arm-functions for usage details.. Please see https://aka.ms/arm-functions for usage details.'.", "additionalInfo": [{"type": "TemplateViolation", "info": {"lineNumber": 16, "linePosition": 5, "path": "properties.template.resources[0]"}}]}

Varma 1,495 Reputation points

2025-04-10T03:56:03.2766667+00:00

HI Vinod,

I will check and will let you know by EOD today,

Thank you.
Vinod Pittala 1,505 Reputation points Microsoft External Staff

2025-04-11T04:04:01.77+00:00

Hello Varma,

Have you had a chance to review the provided solution?

Thanks
Varma 1,495 Reputation points

2025-04-13T04:06:04.06+00:00

Hi Vinod,

I tried to use same template you have given , but based on below error message I understood that it is expecting to resource group is should be there already, is that so?

and you can see above parameters file

PS I:\ARMTemplates\DevOps\ACR-KV> az deployment sub create --location eastus --template-file azuredeploy.json --parameters "@azuredeploy.parameters.json"

Please provide string value for 'location' (? for help): eastus

{"status":"Failed","error":{"code":"DeploymentFailed","target":"/subscriptions/9e6baf99-22ca-4234-948e-7d4a9f8ccd32/providers/Microsoft.Resources/deployments/azuredeploy","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"ResourceGroupNotFound","message":"Resource group 'DRG' could not be found."}]}}

Please suggest.

Thank you.
Varma 1,495 Reputation points

2025-04-14T04:56:51.4433333+00:00

@Vinod Pittala (MINDTREE LIMITED)

Did you get a chance to look my above comment?
Vinod Pittala 1,505 Reputation points Microsoft External Staff

2025-04-14T05:18:01.47+00:00

Hello Varma,

Yes, In order to create a Key vault and ACR, we need a RG first, here the mentioned "DRG" resource group does not exist. so please create that DRG resource group first and then try executing the script to create key vault and ACR.

Thanks
Varma 1,495 Reputation points

2025-04-14T05:40:36.8033333+00:00

Hi Vinod,

But I want to create a Resource group also from ARM template only not manual, thats is why we are using subscription level scope , we are using right?

Vinod Pittala 1,505 Microsoft External Staff

Hello

Please use the below script to deploy the resources ensure acrname and keyvault name should be globally unique.

Let me know the results.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-08-01/subscriptionDeploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "resourceGroupName": {
      "type": "string"
    },
    "location": {
      "type": "string"
    },
    "acrName": {
      "type": "string"
    },
    "keyVaultName": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Resources/resourceGroups",
      "apiVersion": "2021-04-01",
      "name": "[parameters('resourceGroupName')]",
      "location": "[parameters('location')]",
      "properties": {}
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2021-04-01",
      "name": "nestedDeployment",
      "resourceGroup": "[parameters('resourceGroupName')]",
      "dependsOn": [
        "[resourceId('Microsoft.Resources/resourceGroups', parameters('resourceGroupName'))]"
      ],
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {
            "acrName": {
              "type": "string"
            },
            "keyVaultName": {
              "type": "string"
            },
            "location": {
              "type": "string"
            }
          },
          "resources": [
            {
              "type": "Microsoft.ContainerRegistry/registries",
              "apiVersion": "2019-05-01",
              "name": "[parameters('acrName')]",
              "location": "[parameters('location')]",
              "sku": {
                "name": "Standard"
              },
              "properties": {}
            },
            {
              "type": "Microsoft.KeyVault/vaults",
              "apiVersion": "2019-09-01",
              "name": "[parameters('keyVaultName')]",
              "location": "[parameters('location')]",
              "properties": {
                "sku": {
                  "family": "A",
                  "name": "standard"
                },
                "tenantId": "[subscription().tenantId]",
                "accessPolicies": [],
                "enabledForDeployment": true,
                "enabledForTemplateDeployment": true,
                "enabledForDiskEncryption": false
              }
            }
          ]
        },
        "parameters": {
          "acrName": {
            "value": "[parameters('acrName')]"
          },
          "keyVaultName": {
            "value": "[parameters('keyVaultName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          }
        }
      }
    }
  ]
}

Varma 1,495 Reputation points

2025-04-14T14:01:46.36+00:00

Hi Vinod,

It seems it worked. Could you please clarify my follow up questions:

1.

when deploying It is getting prompt to enter location, why it is so? what need to be done to avoid asking that?

2.

I see parameters in your file as below in the down the main file you have given and also there is separate param file there also parameters are there, which one will over take?

From main file:

From parameter file:

3.

Usually which parameter to keep? which one to use? in my case is it okay even I dont user parameter file when I used your main file since it already having parameters in the down.
Varma 1,495 Reputation points

2025-04-15T03:23:44.73+00:00

@Vinod Pittala (MINDTREE LIMITED)

Did you get a chance to look my above comment?
Vinod Pittala 1,505 Reputation points Microsoft External Staff

2025-04-16T02:28:30.1033333+00:00
Hello Varma,

Apologies for the delay in my response.

Thanks for the confirmation on the provided answer. additionally, here is the clear explanation for your queries.

1. when deploying It is getting prompt to enter location, why it is so? what need to be done to avoid asking that?

Ans: You must provide --location because Azure needs a location to "anchor" the subscription-level deployment metadata, not for the actual resources you're deploying.

Even though the resources (like your ACR and Key Vault) are being deployed to a specific location, the deployment itself (as an operation object) lives in a region too.

To avoid being prompted each time, you must explicitly pass the --location argument when using az deployment sub create.

See the below example for your reference:

az deployment sub create \ --location eastus \ --template-file mainTemplate.json \ --parameters resourceGroupName=my-rg location=eastus acrName=myacr keyVaultName=mykv

I see parameters in your file as below in the down the main file you have given and also there is separate param file there also parameters are there, which one will over take?

Ans:

Main template: If you remove the forwarding section in the main template, the nested template won’t get the values (acrName, keyVaultName, location), and the deployment might fail because those parameters will be undefined in the nested template.

Parameters file: If you pass the parameters via a parameters file (parameters.json) or directly in the command line, it won't matter if the parameters block exists in the main template. As long as those parameters are provided at the time of deployment, everything will work fine.

--location in this context is for where to store the deployment record, not the region of your ACR or Key Vault.

3.Usually which parameter to keep? which one to use? in my case is it okay even I dont user parameter file when I used your main file since it already having parameters in the down.

Ans: You are initiating the parameters in main file and defining the values of parameters in the parameter file. The parameter file is an optional way to provide values during deployment, but it’s not required if the values are already included in the main template.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Thanks
Varma 1,495 Reputation points

2025-04-16T06:23:50.08+00:00

HI Vinod,

Are you referring below section as forworded section?

and if values are included in the main file, that will become hardcoded right?

so in that case what is the best way provide parameter values in ARM template?
Vinod Pittala 1,505 Reputation points Microsoft External Staff

2025-04-16T09:14:01.55+00:00
Hello Varma,

Yes, as previously explained, this block is part of the Microsoft.Resources/deployments resource and is required to pass parameters from the parent to the nested template.

and if values are included in the main file, that will become hardcoded right?

Yes, which is usually not ideal.

so in that case what is the best way provide parameter values in ARM template?

The better approach is to supply parameter values at deployment time, using inline parameters flag instead of a separate parameter file as shown below.

az deployment sub create \ --location eastus \ --template-file mainTemplate.json \ --parameters resourceGroupName=my-rg location=eastus acrName=myacr keyVaultName=mykv

Thanks
Vinod Pittala 1,505 Reputation points Microsoft External Staff

2025-04-22T02:09:55.6733333+00:00

Hello Varma,

I just wanted to check if the above provided solution worked for you or if you need any further assistance?

Please feel free to let us know, as we are always here to help whenever you need us.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Thank you.

Accepted answer

0 additional answers

Your answer

Varma 1,495 Reputation points

2025-04-10T03:56:03.2766667+00:00

HI Vinod,

I will check and will let you know by EOD today,

Thank you.
Vinod Pittala 1,505 Reputation points Microsoft External Staff

2025-04-11T04:04:01.77+00:00

Hello Varma,

Have you had a chance to review the provided solution?

Thanks
Varma 1,495 Reputation points

2025-04-13T04:06:04.06+00:00

Hi Vinod,

I tried to use same template you have given , but based on below error message I understood that it is expecting to resource group is should be there already, is that so?

and you can see above parameters file

PS I:\ARMTemplates\DevOps\ACR-KV> az deployment sub create --location eastus --template-file azuredeploy.json --parameters "@azuredeploy.parameters.json"

Please provide string value for 'location' (? for help): eastus

{"status":"Failed","error":{"code":"DeploymentFailed","target":"/subscriptions/9e6baf99-22ca-4234-948e-7d4a9f8ccd32/providers/Microsoft.Resources/deployments/azuredeploy","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"ResourceGroupNotFound","message":"Resource group 'DRG' could not be found."}]}}

Please suggest.

Thank you.
Varma 1,495 Reputation points

2025-04-14T04:56:51.4433333+00:00

@Vinod Pittala (MINDTREE LIMITED)

Did you get a chance to look my above comment?
Vinod Pittala 1,505 Reputation points Microsoft External Staff

2025-04-14T05:18:01.47+00:00

Hello Varma,

Yes, In order to create a Key vault and ACR, we need a RG first, here the mentioned "DRG" resource group does not exist. so please create that DRG resource group first and then try executing the script to create key vault and ACR.

Thanks
Varma 1,495 Reputation points

2025-04-14T05:40:36.8033333+00:00

Hi Vinod,

But I want to create a Resource group also from ARM template only not manual, thats is why we are using subscription level scope , we are using right?
Varma 1,495 Reputation points

2025-04-14T14:01:46.36+00:00

Hi Vinod,

It seems it worked. Could you please clarify my follow up questions:

1.

when deploying It is getting prompt to enter location, why it is so? what need to be done to avoid asking that?

2.

I see parameters in your file as below in the down the main file you have given and also there is separate param file there also parameters are there, which one will over take?

From main file:

From parameter file:

3.

Usually which parameter to keep? which one to use? in my case is it okay even I dont user parameter file when I used your main file since it already having parameters in the down.
Varma 1,495 Reputation points

2025-04-15T03:23:44.73+00:00

@Vinod Pittala (MINDTREE LIMITED)

Did you get a chance to look my above comment?
Varma 1,495 Reputation points

2025-04-16T06:23:50.08+00:00

HI Vinod,

Are you referring below section as forworded section?

and if values are included in the main file, that will become hardcoded right?

so in that case what is the best way provide parameter values in ARM template?
Vinod Pittala 1,505 Reputation points Microsoft External Staff

2025-04-16T09:14:01.55+00:00

Hello Varma,

Yes, as previously explained, this block is part of the Microsoft.Resources/deployments resource and is required to pass parameters from the parent to the nested template.

and if values are included in the main file, that will become hardcoded right?

Yes, which is usually not ideal.

so in that case what is the best way provide parameter values in ARM template?

The better approach is to supply parameter values at deployment time, using inline parameters flag instead of a separate parameter file as shown below.

az deployment sub create \ --location eastus \ --template-file mainTemplate.json \ --parameters resourceGroupName=my-rg location=eastus acrName=myacr keyVaultName=mykv

Thanks
Vinod Pittala 1,505 Reputation points Microsoft External Staff

2025-04-22T02:09:55.6733333+00:00

Hello Varma,

I just wanted to check if the above provided solution worked for you or if you need any further assistance?

Please feel free to let us know, as we are always here to help whenever you need us.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Thank you.

Answer 1

Hello Varma,

It has been identified that the provided 'Template schema' is currently not supported.

The schema 'https://schema.management.azure.com/schemas/2019-11-01/subscriptionDeploymentTemplate.json#'

Please use one of the supported versions instead: '2015-01-01', '2018-05-01', '2019-04-01', or '2019-08-01'. For your convenience, we have added the supported version. Kindly use the API below.

"$schema": "https://schema.management.azure.com/schemas/2019-08-01/subscriptionDeploymentTemplate.json#",

And also identified that you are trying to create a RG inside another resource group, which is incorrect. Microsoft.Resources/resourceGroups

For your ease of reference, please use below template

{
  "$schema": "https://schema.management.azure.com/schemas/2019-08-01/subscriptionDeploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "resourceGroupName": {
      "type": "string"
    },
    "location": {
      "type": "string"
    },
    "acrName": {
      "type": "string"
    },
    "keyVaultName": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2021-04-01",
      "name": "nestedDeployment",
      "resourceGroup": "[parameters('resourceGroupName')]",
      "dependsOn": [],
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {
            "acrName": {
              "type": "string"
            },
            "keyVaultName": {
              "type": "string"
            },
            "location": {
              "type": "string"
            }
          },
          "resources": [
            {
              "type": "Microsoft.ContainerRegistry/registries",
              "apiVersion": "2019-05-01",
              "name": "[parameters('acrName')]",
              "location": "[parameters('location')]",
              "sku": {
                "name": "Standard"
              },
              "properties": {}
            },
            {
              "type": "Microsoft.KeyVault/vaults",
              "apiVersion": "2019-09-01",
              "name": "[parameters('keyVaultName')]",
              "location": "[parameters('location')]",
              "properties": {
                "sku": {
                  "family": "A",
                  "name": "standard"
                },
                "tenantId": "[subscription().tenantId]",
                "accessPolicies": [],
                "enabledForDeployment": true,
                "enabledForTemplateDeployment": true,
                "enabledForDiskEncryption": false
              }
            }
          ]
        },
        "parameters": {
          "acrName": {
            "value": "[parameters('acrName')]"
          },
          "keyVaultName": {
            "value": "[parameters('keyVaultName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          }
        }
      }
    }
  ]
}

Please try and let us know the results. If the provided answer helps your query, please click Upvote it.

Thanks

Share via

Failing to create resource using subscription level ARM template

0 additional answers

Your answer